LegacyLink
Rest of Africa

NDPR, Kenya DPA & Ghana DPA — how LegacyLink supports African institutions

LegacyLink is designed for schools and universities across Nigeria, Kenya, Ghana and the wider region to run alumni programmes in line with local data-protection regimes that mirror much of GDPR.

Last updated: 2026. For a specific data processing agreement, email info@legacylink.tech.

Frameworks in scope

  • Nigeria — Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023, supervised by the Nigeria Data Protection Commission.
  • Kenya — Data Protection Act 2019, supervised by the Office of the Data Protection Commissioner.
  • Ghana — Data Protection Act 2012 (Act 843), supervised by the Data Protection Commission.

Roles

The institution is the Data Controller. SalesCollab (Pty) Ltd, operating LegacyLink, is the Data Processor engaged under a written processing agreement.

Lawful basis

Alumni relationship communications are processed on the basis of legitimate interests and the ongoing relationship. Marketing by third-party sponsors requires explicit, revocable consent.

Data subject rights

Access, rectification, erasure, restriction, portability and objection rights are surfaced through the in-product privacy centre and honoured within statutory timeframes (typically 30 days).

Cross-border transfers

Transfers to processors outside Nigeria, Kenya or Ghana are made under contractual safeguards equivalent to the local regime, with a transfer assessment available on request.

Local registration

Where the institution requires the processor to be registered (e.g. Kenya's ODPC registration), LegacyLink will support the institution's own registration process and provide the documentation needed.

Security controls

  • Tenant isolation via row-level security.
  • AES-256 encryption at rest, TLS 1.2+ in transit.
  • Append-only audit logs on privileged actions.
  • Mobile-money-friendly payment integrations are on the Phase 2 roadmap for African institutions.

Shared responsibility: LegacyLink provides the platform controls described above. Each institution (the data controller) is responsible for its own lawful basis, alumni notices, retention decisions, and any additional local requirements. This page is app-owner editable content, not independent legal advice or a certification issued by a third party.